The File Uploads Addon for WooCommerce prior to version 1.7.6 does not verify that a customer requesting an uploaded file is the original uploader. Any user who knows or can guess a file name can download that file without authentication, resulting in the exposure of potentially confidential customer data. This flaw permits an attacker to read files that belong to other users, violating the confidentiality of those files and the privacy of customers.

WooCommerce File Uploads Addon for WordPress, versions 1.7.2 through 1.7.5. The plugin is used in WordPress sites that have WooCommerce installed and allows customers to upload files that are stored on the site. Sites running any of these versions are vulnerable.

The CVSS score is 5.9. The vulnerability is exploitable by simply constructing an HTTP request to the file URL once a file name is known or guessed. No authentication is required, making it straightforward for an unauthenticated attacker to obtain other customers' files. The EPSS score is <1%, indicating a very low probability of exploitation in the near future. The CVE is not listed in the CISA KEV catalog, suggesting widespread exploitation has not yet been reported. Nevertheless, the absence of authentication and the potential confidentiality impact warrant a moderate to high risk rating, especially for sites that store sensitive customer uploads.